AttackIQ

For this particular customer, threat attack surface understanding, assessment, or simulation was the main requirement of the company, and we wanted to run simulation tests which manual tests cannot match, leveraging the MITRE ATT&CK surface framework to understand which were the relevant threats for that particular customer's environment.

The other use case was obviously about breach and attack simulation, which is a mature area with other vendors, but the main use case was threat attack surface management.

AttackIQ gave the customer visibility into threat areas they were previously unaware of, prompting them to manage those threats and their associated risks because if they don't know a relevant threat exists, they won't manage it, thus improving their understanding and approach to their threat attack surface.

The ransomware readiness assessment used to take weeks when done manually for certain in-scope applications, but with AttackIQ, the pre-built questionnaire streamlines the process, saving valuable time and improving the quality of responses compared to manual efforts.

AttackIQ offers a SaaS model, allowing the customer to avoid the headache of maintaining infrastructure, and since it's a simulation tool, customers can run tests safely without issues or the tension of causing disruptions in the live network, and the assurance provided by AttackIQ as a vendor gave them considerable confidence.

For SaaS, the customer doesn't have to install anything, and there are no infrastructure components in the customer environment, which helped the customer consider the SaaS product to avoid introducing another solution into their environment.

Regarding the simulation features, AttackIQ has a good, extensive library of pre-built scenarios that the customer can pick and choose from as per their environment and use case, which the customer appreciated, along with the mapping of the assessment to MITRE ATT&CK and the persona-based reporting which proved quite useful for engineers, architects, and C-level personnel.

From a governance perspective, I think AttackIQ is good, and our team hasn't raised any concerns; we aren't giving any autonomous authority to AttackIQ, so from that perspective, it is satisfactory.

The accuracy and reliability of AttackIQ's output are quite good, as the team is happy with the outcome of the ransomware readiness assessment, finding minimal gaps or quality issues when compared to our previous manual processes.

I believe that AttackIQ can improve the learning curve by simplifying and gamifying the initial experience to enable teams to use AttackIQ more effectively.

The customer heavily engages in MCP deployment, which involves various threats, suggesting that AttackIQ could expand its library of MCP assessment use cases and provide more capabilities regarding threats related to MCP.

I was using AttackIQ for one of our customers who were looking for a similar solution in the field where attack simulation, breach and attack simulation, and threat management surface assessment were required, and during that assessment, I encountered AttackIQ as a solution.

It's too early to say, but so far, AttackIQ is stable.

They have assured us that AttackIQ is very scalable, and since it's SaaS-based, we don't foresee any challenges from a scalability perspective.

The customer support from AttackIQ has been good, providing any information we needed during the POC testing part, and they have a supportive partner ecosystem as well.

At this point in time, I would rate the customer support eight out of ten.

We are in the process of comparing AttackIQ with another solution, which is XM Cyber, which can be found on PeerSpot.

The deployment of AttackIQ is likely hybrid cloud; however, since we are still in the POC stage and comparing with XM Cyber, no final deployment decision has been reached yet.

My rating of eight for capability and seven for ROI stems from the total cost of ownership and ROI, particularly from the commercial perspective rather than technical capabilities.

The purchase part for AttackIQ is pending since we have yet to make a final decision between AttackIQ and XM Cyber.

From a technical viewpoint regarding pricing, I've heard that the pricing point is around a couple of thousand dollars per test point, which is considered a bit high, but I understand that AttackIQ is willing to provide a better offer.

Prior to choosing AttackIQ, we evaluated XM Cyber as well.

From a capability perspective, I would rate AttackIQ eight out of ten, and from an ROI perspective, based on what I've heard from the other team, particularly in comparison with XM Cyber, I would say seven out of ten.

We are a multi-cloud entity with setups across AWS, Azure, Google, and on-premises as well.

My recommendation to others reading reviews on PeerSpot would be to understand the use case, define the outcome you want to achieve, and select the right assessment case aligned to your desired outcome, which will aid in decision-making; also, ensuring you have the right team skill set and capabilities is crucial for a smoother experience.

My main use case for AttackIQ is for security information and event management. I monitor incidents, check and analyze them, and then respond to the incidents. I use AttackIQ for more observations and analysis.

The orchestrations and automations of AttackIQ impact my organization positively. We can integrate all of that for process improvement, which will be the best improvement we can provide to the organization or the company.

AttackIQ has reduced the incident response times and response for the objectives to improve the efficiency of incidents. From investigations and analysis that previously took four to eight hours, I can now complete them in about ten minutes because of the automations and orchestration. Additionally, for the validation of trusted sites and verifications like VirusTotal, the Threat Vault, and ThreatFox, the system will automatically respond to an incident that occurred.

AttackIQ offers quick response and gathers more information so I could identify some compromise or incident compromise and perform some analysis.

I love the feature for detection engineering, security control validations, zero trust, MITRE ATT&CK, third-party risk validation, and defense optimization. AttackIQ Ready! validations, AttackIQ Flex, and the Command Center help my workflow.

For the governance and security of AttackIQ, I believe these surpass the standards of ISO and the NIST standard. Upon review, the optimizations and documentation of AttackIQ are great. The information is complete, and overall, it is awesome.

For the accuracy and reliability of output, AttackIQ provides very great information, especially for every incident or request that has occurred. As I have experienced, it provided a great outcome, trustable results, and verified results.

Overall, it is great and awesome. I am very happy and thankful for AttackIQ for providing this great application with complete platforms ready. The Enterprise, Command Center, operating system, and solution are great, covering detection engineering, compliance optimizations, defense optimizations, and security control validations. The at-scale offensive testing is great as well, along with red team augmentations, adversary emulation, reduced exposure, and vulnerability prioritization.

The optimized defensive posture and especially the zero trust aspect make me very happy regarding AttackIQ, especially its MITRE ATT&CK integrations and third-party risk validations. That is overall awesome.

I have not used the other features of AttackIQ, but the best part is the integration of other applications that are not currently available for AttackIQ. If they can integrate with AI technology, it would be much better.

For the documentation and support, specifically regarding documentation, it should have a knowledge transfer and knowledge-based data center where I can get important insights or experiences that I can manage to fix my incident response. I should be able to automatically access incidents I created, which includes process improvement, additional information, and especially the AI or artificial intelligence integration.

I have been using AttackIQ for five months.

AttackIQ is stable so far. The information and verification are great, and the analysis and observation are awesome.

AttackIQ's scalability is great because it can manage multiple applications and endpoints.

The customer support is great and awesome. They provide what customers need and sometimes exceed expectations. Overall, it has been great and delivered the best results.

I rate customer support an eight. There are two areas needing improvement for anything that might happen.

Before, we used Wazuh, which is a free open-source application. However, AttackIQ has provided more significant and improved capabilities, especially the solutions it offers, which is why we switched to this application.

Regarding employees, AttackIQ has provided great support and improvement for efficiency. It has had a great turnaround for money saved due to the multiple applications and licensing we used before; now we only focus on this application. However, I cannot provide specific metrics right now because we need that information for our report. Overall, it was a great application and delivered the best results for the company.

I tried the demo or the free version before, and the pricing was great. The price is fair and helpful, as the support is also beneficial. The impact has been good.

We evaluated Wazuh, the expensive Splunk, and CrowdStrike, which is also expensive.

I rate AttackIQ an eight for now. I choose eight for the two remaining aspects that should involve process improvement and further improvements for AttackIQ.

If you are looking into using AttackIQ, I advise ensuring that it is trustworthy. You should be concerned about the integrity of applications as well, and AttackIQ provides reputable information. It can offer the needed information and efficiency that you want to apply in your company. It is easy to manage and use, and the GUI or graphical user interface is good, providing very informative and verified information that you can apply to analyze, respond, and create reports for your organization.

This application is great for reporting, with a dashboard that provides a detailed view of all the information in one place. I think that is the best part I experienced with AttackIQ.

My main use case for AttackIQ is security control and validation, breach and attack simulations, detection validation, and security posture assessment.

I used AttackIQ to simulate MITRE ATT&CK techniques such as phishing related credential access and lateral movement to verify whether Microsoft Defender for Endpoint and our SIEM generated the expected alerts. I reviewed any detection gaps, fine-tuned detection rules, and reran the assessment to confirm the improvements.

My primary focus was validating the effectiveness of our existing security controls rather than just checking compliance. AttackIQ helped me to identify detection gaps, verify the security tools were working as expected after policy changes, and improve my responses by safely simulating real-world attack tactics.

The best features AttackIQ offers include MITRE ATT&CK mapping, automated breach simulations, security control validations, detection gap analysis, and detailed reporting.

AttackIQ has improved my security posture by validating security controls, identifying detection gaps, and increasing confidence in my detection and response capabilities.

The feature I rely on most is security control validation. It gives me confidence that my security controls and detection mechanisms are working as expected against real-world attack techniques. Instead of assuming my defenses are effective, I can validate them regularly, identify gaps, and fine-tune my security tools before an actual incident occurs. I was impressed by the MITRE ATT&CK-based simulations and the depth of the reporting.

I would appreciate even deeper integrations with security tools and more automated remediation recommendations to streamline follow-up actions.

I would appreciate deeper integrations with security tools. AI-assisted remediations and recommendations would be helpful. Easier customization of attack scenarios and more actionable reporting that prioritizes findings based on risk would also be beneficial. One improvement that would make my workflow smoother is more automation around remediation. After a simulation identifies a detection gap, it would be helpful if AttackIQ could recommend specific configuration changes or detection rules based on the security tools in use.

The AI governance appears good, but I would appreciate greater transparency regarding how AI recommendations are generated, stronger administrative controls, and clear data privacy and compliance options for enterprise environments. The AI output is accurate and reliable enough to assist security teams, but it still benefits from human review. Improving contextual awareness and making recommendations more environment-specific would increase confidence in the results.

I have been using AttackIQ for more than three years.

Rating: 4

I suggest defining clear use cases, integrating AttackIQ with your security tools, and running simulations regularly. AttackIQ is a strong platform for security validations. Better integration, AI-driven remediations, and customizable reporting would make it even better. I would rate this product an 8 out of 10.

The key features that we mainly depend on are the continuous validation of security controls through repeatable attack simulations. Whenever there's a breach or attack simulation happening, the support, testing, preventing, detection, and response behind it is completely ongoing.

At the same time, exposure management, rather than just a one-time security assessment, helps us to stay on top of what's happening in the environment and reduces fatigue for a SOC engineer or someone managing the SOC to find the actual attack entrance, the problem behind it, or how the breach might have taken place.

From a SOC perspective, AttackIQ gives us clear evidence of where the controls are working in real conditions and is practically strong for identifying detection gaps and response weaknesses. Being aligned with MITRE ATT&CKs makes it easier to prioritize and communicate our findings back to our clients running in our SOC.

There are several use cases for how we use AttackIQ in our SOC. It is most useful for validating detection coverage, testing response readiness, and confirming whether endpoint and security controls behave as expected. It is also a strong fit for post-deployment validation after introducing new tooling because it helps prove whether the changes actually improve the security posture. AttackIQ works particularly well with ransomware simulations, exposure management programs, and recurring control assessments. For my team that wants to measure defensive capability over time, it provides a structured and repeatable way to do that.

Running in our SOC, it moves the conversation from assumptions and dashboards to measurable proof, which is exactly what makes AttackIQ valuable in day-to-day security operations.

The breach and attack simulation that supports testing, prevention, detection, and response is a key feature for me, as is the ongoing exposure management, rather than a one-time security assessment. AttackIQ's reporting helps translate technical findings into actionable remediation steps, which are easy to understand. The continuous validation of security controls through repeatable attack simulations is a massive advantage for me.

Once properly implemented, AttackIQ becomes a valuable part of a continuous validation program.

The one feature I rely on the most from AttackIQ is specifically the continuous validation of security controls through repeatable attack simulations. From the reporting that stands out, once you have the report, the translation from a technical finding perspective and how they align with actionable remediation steps is easy to understand, which helps significantly.

From a SOC perspective, AttackIQ running in our SOC is a solid enterprise-grade platform delivering genuine operational value. The biggest strength for me is the realism, its alignment with all the compliance situations we might have, and the ability to continuously validate control effectiveness. By doing that, we can continuously provide feedback to our customers to ensure they are running the best of breed for their security posture and environment. AttackIQ is best viewed as a tool that helps a SOC move from assumption-based security to evidence-based security, while providing reporting that can easily be communicated in layman's terms to your customer base. It is most effective for teams that want to prove their controls work, identify gaps early, and continuously improve rather than just rely on periodic testing alone.

There is a learning curve at the beginning, especially for teams that are quite new to a BAS or continuous validation solution. Setup and integration can take time before the platform really delivers full value. AttackIQ works best when a SOC already has a process for acting on findings. One challenge we have had is teams expecting instant results without workflow maturity, which may not yield the full benefit right away. It takes some time to really get the solution or the outcome that you want.

I have been using AttackIQ in our SOC environment for the past four years.

AttackIQ is stable.

AttackIQ is quite scalable as long as you understand what you want to do with it and where you want to go. The important thing is to understand your need and the bigger picture, and then the scalability will come into play.

AttackIQ's customer support is brilliant.

I have not needed customer support too many times, but from the times we have had instances where we needed customer support, I would rate it an eight out of 10.

Previously, we did use a different solution. However, I am not going to say which solution it was, but we switched because of the difficulty in integrations, as the reporting was quite disorganized, difficult to understand, and difficult to really articulate back into layman's terms. The cost was excessive.

The rollout process is quite easy to do because we have a mature SOC team and engineers around it. The understanding process on how to get all of this to tie back into an existing mature SOC took some challenges, but it was easily resolved.

We have seen a massive return on investment with AttackIQ, specifically from a resource perspective and time spent on findings due to the fact that the accuracy of the reporting or the accuracy of the findings from AttackIQ was brilliant. This saves a lot of manpower time.

The accuracy of AttackIQ is very good and the reliable output is straightforward and easy to understand.

The advice I would give to others looking into using AttackIQ is to make sure that your SOC already has a process for acting on findings and that the SOC is mature enough to handle AttackIQ. I rate this review a 9 out of 10.